> TODAY'S SUMMARY (13 articles)
Today's cybersecurity news highlights several critical threats and trends. A significant vulnerability in APT allows verified packages to be replaced and executed with root access on Debian and Ubuntu systems. In the U.S., a Canadian man faces charges for hacking university supercomputers to mine cryptocurrency. CISA warns that hackers are exploiting a patched Apple flaw to deliver info-stealing malware. Companies are increasing their cybersecurity budgets, especially for AI governance, but still struggle with control. Additionally, advancements in AI are intensifying concerns over security, as evidenced by the growing sophistication of AI agents and supply chain attacks, such as the one targeting OpsShield.
|
// AI-powered summary generated at 08:00
Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables.
Presented at Black Hat USA 2026, the research found...
Companies are showcasing their products and services this week at the 2026 edition of the Black Hat conference in Las Vegas.
The post Black Hat USA 2026 – Summary of Vendor Announcements (Part 4) appeared first on SecurityWeek.
Microsoft fixed critical vulnerabilities across Azure, Entra, and SharePoint, while Apple patched a high-severity authentication bypass.
The post Microsoft, Apple Release Fresh Security Updates appeared first on SecurityWeek.
On March 24, 2026, developers building AI applications with LiteLLM — a Python package with 95 million monthly downloads — unknowingly installed malicious code. A threat actor group known as TeamPCP had compromised the PyPI distribution pipeline and pushed malicious versions 1...
OpenAI has updated GPT-5.6 Sol, the model behind ChatGPT for Plus and Pro subscribers, and pushed a new model, GPT-5.6 Luna, out to everyone using the free tier. The company is also removing the rate limit on text conversations for free users, allowing them to keep chats going without waiting for th...
Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, disclose victim IP addresses and mapped ports, and exhaust NAT tables.
Presented at Black Hat USA...
AI-generated vulnerability patches still heavily depend on human review, particularly the ones involving security-sensitive code, according to a research.
Researchers from 1Password have disclosed an internal evaluation that found AI-generated fixes frequently overlook broa...
The financial impact of a data breach is substantial for any modern business, regardless of industry or size. IBM’s latest Cost of a Data Breach report discovered that, from March 2025 to February 2026, the average cost of a data breach rose to $6 million, up 35% from $4.44 mi...
Finance, technology and healthcare sectors were particularly heavily targeted in July, according to Comparitech
A GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories. On OpenAI's, it was enough to hijack the next agent run.
Novee Security ran the attack against each vendor's agent in the con...
Information published.
Information published.
UNIX systems (including Linux) are well-known to record a lot of activities in many different locations. But there is one domain where they definitely lack of "modern" logging: shells. Most shells provide an historization of the typed commands through a flat file in the $HOME directory (ex: $HOME/.b...
Hackers stole personal, medical, and health insurance information from a company’s data center.
The post 3.8 Million Impacted by Unlimited Technology Systems Data Breach appeared first on SecurityWeek.
Keepit announced AI Truth Cloud, transforming backup from a compliance requirement into the strategically valuable data asset an organization can hold. As AI agents take on business-critical decisions, AI Truth Cloud positions Keepit as the sovereign source of truth that enterprise AI can safely bui...
The browser refresh eliminates over two dozen memory safety bugs, including critical use-after-free flaws.
The post Critical Vulnerabilities Patched With Chrome 151 Update appeared first on SecurityWeek.
Scammers use AI deepfakes to impersonate OnlyFans creators, trick fans into sending money, then disappear after payment. Criminals are building fake identities using AI-generated deepfakes of real OnlyFans creators, luring their followers with promises of live chats, and then disappearing after coll...
A new analysis has uncovered that the threat actor tracked as TeamPCP has been active on the cybercrime scene as far back as 2020, indicating the group has been compromising internet-facing infrastructure for years before training their sights on the software supply chain.
"The connection is suppor...
In July 2026, Exact Sciences (now owned by Abbott Laboratories) was the target of a ShinyHunters "pay or leak" extortion campaign. The group claimed to have obtained data from the company's cancer diagnostics business, which they later published publicly. The breach contained 10.9M unique email addr...
July 2026 Patch Tuesday was record-setting in so many ways. The sheer volume of security patches for almost every product in the Microsoft portfolio was the highest ever and, of course, well over 600 CVEs were identified in the Security Updates Guide. Interestingly, only two CVEs were reported as ex...